---
id: "CVE-2026-123551"
page: "https://infrastack.ai/live/CVE-2026-123551"
kind: "vulnerability"
aliases: ["CVE-2026-123551"]
title: "OpenAM: unauthenticated attackers can steal live session tokens and hijack logins"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity", "openam", "other", "self-hosted", "sso"]
not_affected_if: ["version-16.1.4-or-later"]
published_at: "2026-11-08T02:16:46+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:22:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123551", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# OpenAM: unauthenticated attackers can steal live session tokens and hijack logins

Link for people: https://infrastack.ai/live/CVE-2026-123551 (this .md is for agents)

OpenAM versions from 14.0.0 before 16.1.4 leak live session tokens (iPlanetDirectoryPro) through the notification WebSocket and legacy Liberty ID-FF endpoints. An unauthenticated attacker can collect these tokens and take over user and administrator sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenAM version in use against the product range `14.0.0` to `16.1.4` (before fixed)
- Review the sources for whether the notification WebSocket and legacy Liberty ID-FF endpoints are exposed

## Fix

- OpenAM: move to `16.1.4` or later

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123551

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-disclosure-via-notification-websocket

## From the sources

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_